KR102177956B1 - Apparatus and method for authenticating - Google Patents

Abstract

An authentication device using a public key encryption algorithm is provided. According to an embodiment, the device generates a first instant public key through a random number generation process in response to a request for generating an electronic signature corresponding to the message. Then, using the first instant public key, a first instant private key paired with the first instant public key is calculated and used.

Description

Authentication device and method {APPARATUS AND METHOD FOR AUTHENTICATING}

It relates to an authentication device and method, and more particularly, to the improvement of the robustness against a security attack of an authentication device based on a public key cryptographic algorithm.

A signature technique using a public key cryptographic algorithm is used for device authentication or digital message signature. For example, the RSA (Rivest Shamir Adleman) algorithm is an Internet encryption and authentication method that performs encryption and decryption by creating a public key and a private key as a set. The private key is used in a device, and the public key is used in an external device such as an authentication authority. Delivered and stored.

On the other hand, if the private key is exposed/lead based on a public key algorithm such as RSA, the signature can be forged, so the private key is a target of a security attack, such as a side channel attack. Among the side-channel attack methods, DPA (Differential Power Analysis) attack, which collects and statistically analyzes a large amount of data, is known to be very powerful.

Meanwhile, PUF (Physically Unclonable Function) may provide an unpredictable digital value. Individual PUFs are given an exact manufacturing process, and even though they are manufactured in the same process, the digital values provided by the individual PUFs are different. PUF may also be referred to as POWF (Physical One-Way Function practically impossible to be duplicated), which cannot be duplicated.

The non-replicable nature of this PUF can be used to generate an identifier of a device for security and/or authentication. For example, a PUF can be used to provide a unique key to distinguish devices from one another.

In Korean Patent Registration No. 10-1139630 (hereinafter '630 patent), a method of implementing a PUF has been suggested. The '630 patent proposes a method in which the generation of inter-layer contacts or vias between the conductive layers of the semiconductor is determined probabilistically by using the process variation of the semiconductor. Became.

According to embodiments, an authentication apparatus and an authentication method robust against side-channel attacks are provided. For example, an authentication device and method that makes DPA attacks impossible and meaningless while using a public key-based algorithm are presented. According to embodiments, a public key-private key pair is a fixed value, so that it is not used repeatedly, and instead may be instantly generated and used when authentication is required.

According to one side, there is provided an authentication apparatus that includes at least one processor and performs an authentication procedure according to an encryption algorithm using public key, such as RSA, which is an asymmetric keys encryption algorithm. The device has pre-generated fixed private keys p and q. According to an embodiment, an apparatus includes: a generator configured to generate a first instant public key in response to a case where an electronic signature corresponding to the algorithm is required; A calculation unit that calculates a first instant private key paired with the first instant public key in the algorithm using the fixed private key and the first instant public key; And a processing unit for generating an electronic signature by the algorithm using the first instant private key. The generation unit, the calculation unit, and the processing unit may be implemented at least temporarily by the at least one processor. According to an embodiment, the device further includes a communication unit for transmitting a message to be transmitted together with the electronic signature and the first instant public key to the counterpart device.

According to an embodiment, the device generates and holds the fixed private key through a public key key generation algorithm. The fixed private key is used when calculating the first instant private key using the first instant public key and when generating a fixed public key that is transferred to another device during the issuing process prior to use and used for later signature verification. do. By way of example, but not limitation, the authentication apparatus may further include a PUF that provides a hardware fingerprint using a process variation that occurs randomly. According to an embodiment, the value of this PUF may be used directly or indirectly as the fixed private key value. In this case, there is no need to directly store the fixed private key in a memory, so that the fixed private key can be protected from physical attacks. This is strongly guaranteed that the fixed private key exists only in the corresponding device, so it is also guaranteed that an instant public key-private key pair cannot be arbitrarily created in another device. Also, in another embodiment, the value of the PUF may be used directly or indirectly to generate instant public keys. For example, it can be used as a seed value or a source value in the process of generating a random number. In this case, by using the PUF as a source value of the random number generation algorithm, the random number generation results generated for each device are independent of each other and the value is You can expect additional effects to make them different.

Meanwhile, in response to receiving a retransmission request from the counterpart device, it may respond as follows. In the case of a retransmission request due to a simple communication error, the generated message can be retransmitted. However, in other cases, for example, when it is suspected that there is an incorrect signature or attack, the first instant public key is discarded, a new second instant public key different from this is generated, and a digital signature is again generated and transmitted.

According to one embodiment, when it is determined from the calculation result that the first instant private key paired with the first instant public key does not exist, the generation unit discloses a second instant different from the first instant public key. Generate the key. Then, the calculation unit calculates a second instant private key paired with the second instant public key in the algorithm. Meanwhile, the generation unit may determine and provide a number obtained by adding an integer of 2 to the first instant public key as the second instant public key instead of performing the process of generating the random number to generate the second instant public key. The integer "2" added to the first instant public key is exemplary and may be changed to a different value. If the encryption algorithm is a RSA-CRT (Chinese Remainder Theorem) algorithm, the first instant private key calculated by the calculation unit includes a first dP value and a first dQ value. In this RSA-CRT embodiment, if it is determined that either of the first dP value and the first dQ value according to the calculation result does not exist, the generation unit is a second instant public key different from the first instant public key. Generate a public key. Further, the calculator calculates a second dP value and a second dQ value paired with the second instant public key in the algorithm.

According to the other side, an authentication device, such as a certification authority (CA), is provided that includes at least one processor and verifies an electronic signature transmitted by an external device according to a public key-based encryption algorithm. The device may include a processing unit for verifying the digital signature using a fixed public key of the counterpart device held by the counterpart device, and a first instant public key instantaneously generated by the counterpart device and transmitted with the electronic signature. have.

According to an embodiment, the apparatus may further include a determination unit that determines that the first instant public key is invalid if the first instant public key is not an odd number of 3 or more. Meanwhile, the processing unit and the determination unit may be implemented at least temporarily by the at least one processor.

According to another aspect, there is provided an authentication apparatus including at least one processor, comprising: a determination unit determining whether a first instant public key received from a counterpart device is a valid value; And a processing unit for encoding data to be transmitted using the fixed public key of the counterpart device and the first instant public key held when the first instant public key is a valid value. The determination unit and the processing unit may be implemented at least temporarily by the at least one processor. For example, but not limited to, the first instant public key may be generated by the counterpart device through a random number generation process.

According to an embodiment, if the first instant public key is not an odd number of 3 or more, the determination unit may determine that the first instant public key is invalid. According to another aspect, there is provided an authentication apparatus including at least one processor and performing an authentication procedure according to a public key-based encryption algorithm. The apparatus includes: a generator configured to generate a first instant public key through a random number generation process in response to the authentication procedure to be performed; A calculation unit that calculates a first instant private key paired with the first instant public key in the algorithm using the first instant public key; And when a message encoded using the first instant public key and a fixed public key previously held in the counterpart device is received from the counterpart device that has received the first instant public key, the first instant private key is used. It may include a processing unit for decoding the message. The generation unit, the calculation unit, and the processing unit may be implemented at least temporarily by the at least one processor.

According to an embodiment, the authentication device may further include a PUF that provides a hardware fingerprint using a process deviation that occurs randomly. In this case, the process of generating the random number includes a random number generation algorithm using the hardware fingerprint value as a source value.

According to an embodiment, when it is determined from the calculation result that the first instant private key paired with the first instant public key does not exist, the generation unit Generate a public key. In addition, the calculation unit may calculate a second instant private key paired with the second instant public key by the algorithm.

According to another aspect, there is provided a non-executive computer program stored on a computer-readable recording medium. The program may include the following instruction sets for causing the processor to operate when executed in a computing device including a processor. The instruction sets include: an instruction set for causing the processor to generate a first instant public key through a random number generation process in response to a request for generating an electronic signature corresponding to the message; An instruction set for causing the processor to calculate a first instant private key paired with the first instant public key by using the first instant public key; And an instruction set for causing the processor to generate an electronic signature based on a public key-algorithm using the first instant private key.

According to another aspect, there is provided a non-executive computer program stored on a computer-readable recording medium. The program may include the following instruction sets for causing the processor to operate when executed in a computing device including a processor. The instruction sets include: an instruction set for causing the processor to determine whether a first instant public key received with a message and an electronic signature from an external device is valid; And an instruction set for causing the processor to verify the digital signature using a fixed public key of the counterpart device stored in the computing device and the received first instant public key when the first instant public key is valid. It may include.

1 is a block diagram showing an authentication device that provides an instant public key and an instant private key according to an embodiment.
2 is a block diagram illustrating an authentication device that receives and uses an instant public key generated by a counterpart according to an embodiment.
3 is a flowchart illustrating a process of verifying an electronic signature according to an embodiment.
4 is a flowchart illustrating an encoding and decoding process according to an embodiment.
Fig. 5 is a flow chart showing processing when an instant private key does not exist according to an embodiment.
6 is a flowchart illustrating processing when a private key does not exist when applying the RSA-CRT algorithm according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, the scope of the rights is not limited or limited by these embodiments. The same reference numerals in each drawing indicate the same members.

The terms used in the description below have been selected as general and universal in the related technology field, but there may be other terms depending on the development and/or change of technology, customs, preferences of technicians, and the like. Therefore, terms used in the following description should not be understood as limiting the technical idea, but should be understood as exemplary terms for describing embodiments.

In addition, in certain cases, there are terms arbitrarily selected by the applicant, and in this case, detailed meanings will be described in the corresponding description. Therefore, terms used in the following description should be understood based on the meaning of the term and the contents throughout the specification, not just the name of the term.

1 is a block diagram showing an authentication device that provides an instant public key and an instant private key according to an embodiment. The device 100 may be at least a portion of a computing terminal including at least one processor. This computing terminal may be, by way of example, but not limited to, a smartphone, a tablet, a laptop, a general purpose computer, a server, or a dedicated terminal for encrypted communication, or the like. The device 100 performs an authentication procedure according to a public key-based encryption algorithm, for example, an asymmetric key encryption algorithm such as RSA.

According to an embodiment, the generator 110 of the device 100 generates a first instant public-key "E" in response to a case where an electronic signature corresponding to the RSA algorithm is required. The generation of the first instant public key E may be performed through a random number generating process. Meanwhile, the generated E must be an odd number of 3 or more. This is because even if it is a prime or a very large number, it must be a pseudo-prime. The generation unit 110 may check whether the generated E is an odd number and whether the value is not 1.

Meanwhile, according to an embodiment, the device 100 may include a PUF (not shown) that provides a hardware finger-print using a semiconductor process variation that occurs randomly. There are also several examples of implementing a PUF using semiconductor process variations. For example, a PUF may be implemented using the random formation-formation failure result of vias or inter-layer contacts disposed between conductive layers of a semiconductor, and this is disclosed in detail. The specification of the '630 patent is incorporated herein by reference.

Meanwhile, in this exemplary situation, the hardware fingerprint provided by the PUF may be used for the fixed private key generation algorithm. The fixed private keys (p, q) that the device basically has (301) is a prime number, and when generating them, a hardware fingerprint may be used as a candidate value of the fixed private keys (p, q). In this case, only the difference between the hardware fingerprint value and the actually generated fixed private key (p, q) value needs to be recorded in the memory. Since the recorded value is enough to be 32-bit, it is impossible to guess the original fixed private key (p, q) using only this value. In addition, it is also possible to quickly reproduce a fixed private key value from a hardware fingerprint value if necessary.

Meanwhile, in this exemplary situation, the hardware fingerprint provided by the PUF may be used for the random number generation algorithm. For example, a hardware fingerprint may be used as a seed key or a source value required in a random number algorithm operating in software and/or hardware.

When the first instant public key E is generated by Equation 1 above, the calculation unit 120 uses the first instant public key E according to the algorithm according to the calculation method specified in the RSA method, which is an RSA pair of E, again. In other words, the first instant private-key "D" paired with E is calculated.

In this way, generating and calculating the private key-public key, which is the target of the key issuance process in the RSA algorithm, has the following advantages. In the RSA method, there are {D, p, q} for private keys, and {E, N} for public keys provided to the counterpart device. Here, N is the product of p and q, and D and E have a relationship of D × E = 1 mod (p-1)(q-1). Unlike E and N, which are transmitted to other devices or certification authorities, the private keys {D, p, q} that exist only inside the authentication device (and must exist) are subject to security attacks. If D is known to a third party, it is possible to forge digital signatures directly. And, even if D is not known, this RSA encryption is no longer valuable because if a third party knows the p and/or q values, it can be used with E, which is publicly disclosed, to calculate D.

As mentioned above, a side-channel attack, such as DPA (Differential Power Analysis), analyzes the power consumption waveform of a device. Unlike the SPA (Simple Power Analysis) attack, which observes only one current consumption waveform, the actual After collecting a number of waveforms with keys used, this D, p or q is attempted to be obtained by statistical analysis method. SPA attacks may not be successful in a noisy environment or when power consumption is shielded to make observation difficult, but DPA attacks still threaten the safety of the algorithm. This is because, in the process of statistical analysis through multiple waveforms, other outliers such as noise can be canceled out, and meaningful patterns can be found.

In the conventional RSA encryption algorithm, the authentication device has a fixed private key {D, p, q}, and the other authentication authority has the fixed public key {E, N} of this authentication device. Therefore, there was a risk because it was possible for an attacker to collect multiple waveforms required for DPA by repeatedly re-requesting an electronic signature from the device.

However, according to the above embodiment, at least D and E of the private key and public key are not fixed values but are dynamically changing values. In other words, when it is necessary to perform an encryption algorithm such as an electronic signature, D and E are generated to be used for a while immediately. Since the generated D and E are used only one time, even if a digital signature is collected by the attacker, it is statistically meaningless. The embodiments essentially prevent side-channel attacks such as DPA attacks by generating and using E and D that are not fixed but dynamically changed.

Moreover, as described above, even if the hardware fingerprint of the PUF used to randomly generate the first instant public key E is designed to be the same, it is impossible to physically duplicate it because the value is different. And it is almost impossible to observe and analyze the PUF value or structure from outside. Therefore, according to this embodiment, attacking the algorithm itself that generates a random E using the PUF value as a seed is also prevented.

In this way, the first instant public key E is generated, and the first instant private key D, which is a pair of E, is calculated using this. In some cases, D that satisfies Equation 2 above may not exist.

If D does not exist, since a valid "instant D-instant E pair" cannot be created, the generation unit 110 generates a second instant public key E'different from the first instant public key E. With this second instant public key E', the calculation unit 120 calculates the second instant private key D'according to Equation 2. If D'exists, then E'and D'are used, otherwise this process can be repeated.

Here, the process of generating the second instant public key E'by the generation unit 110 may be a process of generating a random number again similar to the process of creating the first instant public key E. However, other embodiments that are simpler than this process are possible. For example, instead of performing the process of generating a random number again, the generation unit 110 subtracts the number (that is, the odd number immediately above E) plus the integer 2 to the first instant public key E that was generated but did not have a corresponding D. 2 It can also be provided by determining the instant public key E'. Here, the integer "2" added to E to generate E'is exemplary, and may be changed to another value. Regenerating E according to the presence or absence of D will be described again with reference to FIG. 5.

On the other hand, the encryption algorithm may be an algorithm using CRT (Chinese Remainder Theorem). In this case, the instant private key to be calculated with E is not one D, but {dP calculated according to Equations 3 and 4 below. , dQ}.

In this RSA-CRT embodiment, if it is determined that either of the valid dP value and the valid dQ value corresponding to E does not exist according to the calculation of the calculation unit 120, E may be similarly regenerated. In this case, the process of generating the random number may be again performed, but E'may be determined simply by adding 2 to E, and dP' and dQ' values corresponding to E'may be calculated. Details will be described again with reference to FIG. 6.

When a valid instant public key (E) and an instant private key (D or {dP, dQ}) are determined through the above process, the RSA-type encryption algorithm may be performed through this. If the digital signature S is generated by signing the message M, the processing unit 130 may perform the following process.

GenSign() is a digital signature generation function and is specified according to the RSA algorithm. The communication unit 140 transmits the generated digital signature S together with the message M to the counterpart device (for example, an authentication authority), but, unlike the prior art, also transmits the instant public key E generated above. Then, the counterpart device will verify the digital signature S by using the instant public key E together with the fixed public key N of the device 100 that already has it. The above process will be described again with reference to FIG. 3.

On the other hand, if the other device encodes and sends the message using the instant public key E transmitted in this way, the device 100 can decode the message using the instant private key D (or dP, dQ) possessed together with p and q. I can. This process will be described later with reference to FIG. 4.

As described above, the risk of a security attack is considerably reduced according to the embodiments, but there may be several other attack attempts that can be expected, and these other attacks may be implemented by the following embodiments. If an attacker can request a key retransmission several times in a very short time. In the case of a communication error, the device 100 according to an embodiment does not re-create the signature by reusing the instant private key, but only retransmits the generated generation. In addition, if there is no communication error, the instant public key that has already been created can be discarded and a new instant public key can be generated. Whether it is a communication error can be checked by whether a communication Ack for a transmission message is received. Alternatives for preventing attacks that can be performed by the counterpart device will be described in more detail with reference to FIG. 2.

2 is a block diagram illustrating an authentication device that receives and uses an instant public key generated by a counterpart according to an embodiment. The device 200 may be, for example, a Certification Authority (CA). In addition, the device 200 may be at least a part of a computing terminal including at least one processor, and the determination unit 210 and the processing unit 220 to be described later may be implemented at least temporarily by the processor.

The device 200 according to an embodiment includes a fixed public key N of the counterpart device held by the counterpart device and a first instant generated by the counterpart device as described in FIG. 1 and transmitted together with a message M and an electronic signature S. It may include a processing unit 220 that verifies the digital signature S by using the public key E.

When the message is to be encoded and sent to the counterpart device, the processing unit 220 encodes the data M to be transmitted using the fixed public key N of the counterpart device held and the first instant public key E received previously. If M', in which M is normally encoded, is transmitted to the external device, the external device will decode M'into M using its own fixed private keys p, q and instant private keys D (or dP and dQ).

Meanwhile, according to an embodiment, the device 200 may further include a determination unit 210 that determines whether the instant public key E sent from the counterpart device is valid. An attacker can predict an attack that creates a digital signature with both E and D set to 1 and delivers it. In this case, digital signature generation and verification operations are not actually performed. Because E and D are used as exponential values in RSA operation, if the value is 1, performing the "1" power of the message for encoding-decoding is the same as not performing the operation. At this time, from the standpoint of the certification authority CA, the signature verification result may be valid. Therefore, in order to prevent this situation, the determination unit 210 checks whether the instant public key E received from the counterpart device is an odd number of 3 or more. So, if E is even or E is 1, it can be judged as invalid E.

Further, the determination unit 210 according to another embodiment may recognize that when E is repeatedly used for more than a specified number of reuse times, it may recognize this as an abnormal situation and treat the instant public key E as invalid.

3 is a flowchart illustrating a process of verifying an electronic signature according to an embodiment. As described above, the difference from the conventional RSA is that the device does not have a fixed private key D, and the other authentication authority does not have the fixed public key E of the device. Accordingly, according to an embodiment, when authentication is required as described above with reference to FIGS. 1 to 2, an instant public key E and an instant private key D calculated by the instant public key E are generated and utilized.

In the illustrated embodiment, the device only has p and q in the reservoir 301. And the certification authority only has N of the fixed public keys of this device. If authentication is required, step 310 is performed. Step 310 is a process of generating a random instant public key E through a process of generating a random number, and the generated E is an odd number of 3 or more. Generation of Instant E and validation thereof are as described with reference to FIG. 1.

Then, in step 320, the RSA pair D of the instant public key E is calculated. The calculation of D can be easily understood by those skilled in the art because of the manner specified in the RSA. Then, in step 330, an electronic signature S is generated for the message M to be transmitted. Then, in step 340, the instant public key E together with the message M and the digital signature S are transmitted to the authentication authority. Then, in step 350 of performing the digital signature verification algorithm, the certification authority will use the previously transmitted E together with the N previously held. Prior to performing step 350, the certification authority may go through a process of verifying whether the received E is valid, which has been described in detail with reference to FIG. 2.

4 is a flowchart illustrating an encoding and decoding process according to an embodiment. A process by which the certification authority encodes the message M and sends it to the device is shown. In step 410, the authentication authority encodes the data M to be transmitted using the fixed public key N of the counterpart device and the instant public key E previously transmitted in step 410. Then, the message M'encoded in step 420 is transmitted to the device, and the device converts M'to M using its fixed private keys p and q and instant private keys D (or dP and dQ) in step 430. Can be decoded.

Fig. 5 is a flow chart showing processing when an instant private key does not exist according to an embodiment. In step 510, the generation unit of the device generates the instant publisher E through the process of generating a random number. Then, in step 520, the calculation unit of the device uses E to calculate the instant private key D, which is the RSA pair of E, according to Equation 2. If this valid D exists in step 530, the authentication process using instant D and instant E is performed as described with reference to FIGS. 1 to 4.

However, if D does not exist in the determination of step 530, the device generator generates a second instant public key E'different from the previous instant public key E. This process may be to go through the process of generating the random number again, but in the example shown in FIG. 5, a simpler embodiment is presented. In step 540, the integer 2 is added to the instant public key E that was previously generated but cannot be used because D does not exist. This process is repeated until there is a valid E-D pair.

6 is a flowchart illustrating processing when a private key does not exist when applying the RSA-CRT algorithm according to an embodiment. First, in the case of the previous embodiment not using the CRT, when the signature is generated and when the CRT is used, the signature is generated as shown in the table below.

Do not use CRT If not When to use CRT D = E ^-1 mod (p-1)(q-1)
N = pq
S = M'' ^D mod N dP = E ^-1 mod (p-1)
dQ = E ^-1 mod (q-1)
qInv = q ^-1 mod p
s ₁ = M'' ^dp mod p
s ₂ = M'' ^dq mod q
h = qInv × (s ₁ -s ₂ ) mod p
S = s ₂ + h × q

In Table 1 above, M'' is a value obtained by adding padding to the hash value of the message M according to the RSA signature format. As can be seen in Table 1, when using CRT, the expression becomes complicated, but the processing data length of "modular exponentiation", which occupies a significant part of the calculation amount in RSA calculation, is 1/2, so the calculation speed is rather than when CRT is not used. Can be 4 to 8 times faster.

If a CRT is used after the random instant public key E is generated (step 610), dP is calculated in step 620, and it is determined whether the dP exists (630). Regardless of the presence of dQ, E cannot be used if this dP does not exist. Accordingly, in step 631, the number of E plus 2 is designated as E again and the process of calculating dP is repeated until this dP exists. Of course, as described above, step 631 is an optional embodiment, so it is possible to regenerate a completely new E through a random number generation process.

If dP exists, the same process is repeated for dQ. The calculation 640 of dQ and the determination of presence or absence 650 and the regeneration 651 of E according to the absence of dQ are as described in steps 620, 630, and 631. And if both valid dP and dQ exist, the encryption algorithm using the CRT will be performed in step 660.

Effects and performance issues according to the above-described embodiments will be briefly described. In the case of generating a random number using a PUF hardware fingerprint as a source value, an external attack is impossible. Even if a pair of E and D is always regenerated and used, if the value of E is too small (for example, less than 16-bit), the same E-D pair may be accidentally used, but this can be prevented by increasing E a little. When the size of E increases, the amount of computation required for digital signature verification increases, but it is not a burden considering the hardware resources of the certification authority that performs such computation. Therefore, the size of the E value can be set to a sufficiently large value, such as 128-bit or more, without deteriorating the performance.

On the other hand, according to embodiments, performance degradation caused by continuously regenerating the E-D pair is not significant. The time complexity of the operation to generate the ED pair is proportional to the length n of the key (time complexity O(n)), and the signature generation operation is proportional to the square or cube of the length n of the key (time complexity O( n ² ) or O(n ³ )). However, since the minimum key length of the recently used RSA is 1024, 2048-bit or more, the computation time for generating an ED pair is one thousandth of the signature generation time, and this amount of time is negligible overall. It's small enough. Therefore, according to the embodiments, side-channel attacks such as DPA are prevented from being inherently unreasonable in hardware or performance degradation.

In the above, although the embodiments have been described by the limited drawings, various modifications and variations are possible from the above description by those of ordinary skill in the art. For example, the described techniques are performed in a different order from the described method, and/or components such as a system, structure, device, circuit, etc. described are combined or combined in a form different from the described method, or other components Alternatively, even if substituted or substituted by an equivalent, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and claims and equivalents fall within the scope of the claims to be described later.

Claims (20)

In the authentication device comprising at least one processor and performing an authentication procedure according to public-key cryptosystems, the authentication device is implemented at least temporarily by the at least one processor:
A generator for generating a first instant public key for a message in response to a case where an electronic signature corresponding to the algorithm is required;
A calculation unit for calculating a first instant private key paired with the first instant public key in the algorithm by using the first instant public key, the fixed private key, and the algorithm; And
A processing unit that generates an electronic signature by the algorithm using the first instant private key, the message, and the fixed private key
Including,
The first instant public key is temporarily generated for the authentication procedure so that the second instant public key is different from the first instant public key,
Each instant private key is an authentication device that is calculated based on the corresponding instant public key. The method of claim 1,
Communication unit that transmits a message to be transmitted to a counterpart device together with the digital signature and the first instant public key
Authentication device further comprising a. The method of claim 2,
In response to receiving a retransmission request from the counterpart device, if a communication Ack is received and it is determined that there is no communication error, the generating unit generates a second instant public key different from the first instant public key . The method of claim 1,
The generating unit is an authentication device that generates the first instant public key through a process of generating a random number. The method of claim 4,
The authentication device further includes a PUF (Physically Unclonable Function) that provides a hardware fingerprint using a process deviation that occurs randomly,
The random number generation process includes a random number generation algorithm using the hardware fingerprint as a source value. The method of claim 4,
When it is determined from the calculation result that the first instant private key paired with the first instant public key does not exist:
The generation unit generates a second instant public key different from the first instant public key; The calculation unit is an authentication device for calculating a second instant private key paired with the second instant public key in the algorithm. The method of claim 6,
Instead of performing the process of generating the random number to generate the second instant public key, the generator determines and provides a number obtained by adding an integer of 2 to the first instant public key as the second instant public key. The method of claim 6,
When the encryption algorithm is a RSA-CRT (Chinese Remainder Theorem) algorithm, the first instant private key calculated by the calculation unit includes a first dP value and a first dQ value,
When it is determined that either of the first dP value and the first dQ value does not exist in the calculation result:
The generation unit generates a second instant public key different from the first instant public key; The calculation unit is an authentication device that calculates a second dP value and a second dQ value paired with the second instant public key in the algorithm. An authentication device including at least one processor and for verifying an electronic signature transmitted by an external device according to a public key-based encryption algorithm, wherein the authentication device is implemented at least temporarily by the at least one processor:
Using the fixed public key of the counterpart device held by the counterpart device, and the first instant public key that the counterpart device instantaneously generated for a message in response to a request for an electronic signature and transmitted with the electronic signature, the digital signature Processing unit to verify
Including,
The first instant public key is temporarily generated for an authentication procedure according to the public key-based encryption algorithm, so that the second instant public key is different from the first instant public key,
Each instant private key is calculated based on the corresponding generated instant public key,
The digital signature is generated by the public key-based encryption algorithm using a first instant private key, the message, and a fixed private key in the counterpart device,
The first instant private key is calculated by the counterpart device using the first instant public key, the fixed private key, and the public key-based encryption algorithm. The method of claim 9,
If the first instant public key is not an odd number of 3 or more, a determination unit that determines that the first instant public key is invalid
Authentication device further comprising a. The method of claim 9,
If the first instant public key is repeatedly generated, a determination unit that determines that the first instant public key is invalid
Authentication device further comprising a. An authentication device comprising at least one processor, wherein the authentication device is implemented at least temporarily by the at least one processor:
A determination unit that determines whether the first instant public key received from the counterpart device is a valid value; And
When the first instant public key is a valid value, a processing unit that encodes data to be transmitted using a fixed public key of the counterpart device and the first instant public key held
Including,
The first instant public key is temporarily generated for an authentication procedure, so that the second instant public key is different from the first instant public key,
Each instant private key is calculated based on the corresponding generated instant public key,
The first instant public key is generated for a message in the counterpart device in response to a request for an electronic signature,
The digital signature is generated by a public key-based encryption algorithm using a first instant private key, the message, and a fixed private key in the counterpart device,
The first instant private key is calculated by the counterpart device using the first instant public key, the fixed private key, and the public key-based encryption algorithm. The method of claim 12,
The first instant public key is generated by the counterpart device through a random number generation process. The method of claim 12,
The determining unit, when the first instant public key is not an odd number of 3 or more, determines that the first instant public key is invalid. The method of claim 12,
The determining unit, when the first instant public key is repeatedly used for more than a predetermined number of reuses, determines that the first instant public key is not valid. An authentication device comprising at least one processor and performing an authentication procedure according to a public key-based encryption algorithm, wherein the authentication device is implemented at least temporarily by the at least one processor:
A generator for generating a first instant public key for a message through a random number generation process in response to the authentication procedure to be performed;
A calculation unit for calculating a first instant private key paired with the first instant public key in the algorithm by using the first instant public key, the fixed private key, and the algorithm; And
When a message encoded using the first instant public key and a fixed public key previously held in the counterpart device is received from the counterpart device that has received the first instant public key, the message, and the fixed private key, the second 1 Processing unit that decodes the message using an instant private key
Including,
The first instant public key is temporarily generated for the authentication procedure so that the second instant public key is different from the first instant public key,
Each instant private key is an authentication device that is calculated based on the corresponding instant public key. The method of claim 16,
The authentication device further includes a PUF (Physically Unclonable Function) that provides a hardware fingerprint using a process deviation that occurs randomly,
The random number generation process includes a random number generation algorithm using the hardware fingerprint as a source value. The method of claim 1,
When it is determined from the calculation result that the first instant private key paired with the first instant public key does not exist:
The generation unit generates a second instant public key different from the first instant public key; The calculation unit is an authentication device for calculating a second instant private key paired with the second instant public key in the algorithm. A non-executive computer program stored on a computer-readable recording medium, wherein when the program is executed on a computing device including a processor, the processor:
An instruction set for generating a first instant public key for a message through a process of generating a random number in response to a request for generating an electronic signature corresponding to the message;
An instruction set for calculating a first instant private key paired with the first instant public key using the first instant public key, a fixed private key, and a public key-based encryption algorithm; And
An instruction set for generating an electronic signature using the public key-based encryption algorithm using the first instant private key, the message, and the fixed private key
Including,
The first instant public key is temporarily generated for an authentication procedure, so that the second instant public key is different from the first instant public key,
Each instant private key is a program stored in a computer-readable recording medium that is calculated based on the corresponding generated instant public key. A non-executive computer program stored on a computer-readable recording medium, wherein when the program is executed on a computing device including a processor, the processor:
An instruction set for determining whether the first instant public key of the message received together with the message and the electronic signature from the counterpart device is valid; And
When the first instant public key is valid, a set of instructions for verifying the digital signature using the fixed public key of the counterpart device stored in the computing device and the received first instant public key
Including,
The first instant public key is temporarily generated for an authentication procedure, so that the second instant public key is different from the first instant public key,
Each instant private key is calculated based on the corresponding generated instant public key,
The digital signature is generated by a public key-based encryption algorithm using a first instant private key, the message, and a fixed private key in the counterpart device,
The first instant private key is a program stored in a computer-readable recording medium calculated using the first instant public key, the fixed private key, and the public key-based encryption algorithm in the external device.

Images